Your Smart Phone Is Your Terminal

Momentum is building fast for card acceptance on ordinary mobile phones. And now Apple could be the next player in this increasingly important game.

The drive to turn mobile devices into point-of-sale terminals without requiring a plug-in card-acceptance device, such as a dongle, got a big shot in the arm in August when Apple Inc. acquired Montreal-based developer Mobeewave Inc.

While speculation runs rampant as to Apple’s plans for Mobeewave, the tech giant, as is its custom, was tightlipped about the deal, saying it “buys smaller technology companies from time-to-time”, and when doing so it “does not discuss its purpose or plans.”

Nevertheless, Apple has a history of incorporating the technology of the smaller tech firms it acquires into its products.

Mobeewave’s software enables mobile devices to securely accept card payments when the card or mobile wallet is tapped to the phone. The technology, also known as NFC phone tap, leverages the near field communications (NFC) chip smart-phone makers have embedded in their hardware for years to support mobile wallets.

To initiate a transaction, a consumer taps her contactless card to the NFC-enabled mobile device. The software reads the card data and transmits it to a processor. A similar technology known as PIN-on-glass uses the same NFC tap-to-phone technology, but also allows mobile devices to accept PINs entered through the device’s keypad, eliminating the need for a PIN pad (“Get Ready for Mobile PINs,” March 2018).

It is not far-fetched then, to think that Apple bought Mobeewave for the express purpose of making Mobeewave’s app standard on iPhones and iPads. After all, Apple is no stranger to payments. The company made Apple Pay a standard app on the iPhone in 2014 and launched its own credit card in 2019.

Buying the 9-year old Mobeewave, for which Apple paid a reported $100 million, gives Apple a ready-made payment-acceptance app for mobile devices. That’s an advantage, payment experts say, because it spares merchants from purchasing add-on hardware.

“Acquiring Mobeewave is a good fit for Apple because its phones come with a secure chip [to enable mobile transactions],” says Sam Shawki, chief executive of Santa Clara, Calif-based MagicCube, which offers a PIN-on-glass application.

Another advantage of the Mobeewave acquisition, Shawki says, is that Apple doesn’t have to develop its own mobile-acceptance application, which means it can come to market with a bona fide solution faster.

‘Going Mainstream’

Enabling smart phones and tablet computers to accept card transactions simply by downloading an app is expected to open the door wider for tens of millions of small cash- and check-only merchants to accept credit and debit cards through mobile devices.

Many of these merchants are one- or two-man operations, such as tradesmen, food trucks, and vendors that sell on the street during events. Despite their lack of size, they represent a rich, untapped vein of potential transaction volume, payment experts say.

Enlisting a manufacturer with a broad distribution network and with a built-in application to accept cards on its mobile device, such as Apple, is a huge step toward making the technology ubiquitous.

“While PIN-on-glass (and NFC phone tap) are still in the early stages of development, Apple’s acquisition of Mobeewave increases the prospect of the technology going mainstream,” says Krista Tedder, director of payment for Pleasanton, Calif-based Javelin Strategy & Research, in an email message. “Most small merchants already have a smart phone, so this technology will likely be attractive to them, because they won’t have to buy a separate piece of hardware to accept cards.”

Besides the opportunity to make card acceptance on mobile phones easier and more affordable for merchants, Apple’s acquisition of Mobeewave also provides a competitive advantage over other smart-phone manufacturers looking to play in the same space.

Prior to the acquisition, Mobeewave worked with Samsung Electronics Co. Ltd. to allow mobile phones to process card transactions without dongles or other card-reader add-ons. The transactions worked via an NFC link between a contactless card and the mobile device. The technology launched in October 2019.

Acquiring Mobeewave denies Samsung access to Mobeewave technology. “Apple is not going to support Android devices,” says Shawki.

If Apple’s acquisition of Mobeewave slows Samsung’s plans to pursue NFC tap-to-phone and PIN-on-glass capabilities, it won’t be for long. Samsung is working with other software developers.

In February, for example, First Data, which is part of Brookfield, Wisc.-based Fiserv Inc., began enabling merchants in Poland to accept cards through mobile devices through an application that accepts contactless card and PIN-on-glass transactions.

Fiserv worked with Samsung and software provider PayCore to bring its application to market. PayCore supplies EMV software to facilitate transactions enabled by Fiserv’s NFC phone tap solution. Fiserv’s solution has been certified by Visa Inc.

Fiserv, which estimates there are 23 million micro-merchants in Europe that lack POS terminals, plans to expand its offering to other countries throughout the Europe, Middle East and Africa region, as well as in Asia-Pacific.

“Our solution brings payment acceptance to micro-merchants, which can’t afford, or don’t want to pay for, card terminals, and typically don’t have a lot of payment solutions available to them,” says Sebastian Gollwitzer, vice president, head of merchant product, EMEA, for Fiserv. “The technology is about democratizing access to payment acceptance for small merchants.”

‘Money Is Moving’

Other players vying for a share of the burgeoning NFC tap-to-phone and PIN-on-glass space include Santa Clara, Calif.-based MagicCube and San Francisco-based Square Inc. Both companies have begun rolling out their respective applications in countries where contactless cards and chip-and-PIN transactions are universal.

“The standards around the technology are global, so we decided to start deploying our technology first in markets outside the United States that are more ready for it,” says Shawki, a former Visa executive who founded MagicCube in 2014. “2021 will be the year of the contactless card in the United States.”

MagicCube, which has developed a PIN-on-glass application for mobile, is currently working with three banks outside the United States and has been certified by all four card networks and EMVCo, the international payments-standards body. In 2019, MagicCube began offering its technology to retailers in Japan.

Square, which has championed the development of standards for PIN-on-glass, debuted the technology in Australia in 2016, then followed suit in the United Kingdom a year later. The company, which revolutionized the acceptance of cards through mobile devices with its Square dongle, which is a miniaturized magnetic stripe reader for mobile devices, views PIN-on-glass as an evolution of the dongle.

“Mobile devices are doing more and more through software, so it’s getting harder to see the purpose of a dedicated POS device for mobile devices to accept card transactions,” says David Talach, head of payments for Square. “Why add a device that adds to the cost of acceptance?”

While improved accessibility to card acceptance for small merchants is a driving force behind deployment of NFC phone-tap and PIN-on-glass applications, it is only one piece of the puzzle.

Transaction security is an equally important aspect of this burgeoning payment technology. Enabling mobile devices to accept a cardholder’s PIN allows the devices to validate the cardholder.

In contrast, dongles and other types of add-on hardware don’t accept PINs. These solutions instead rely on the consumer using his fingers to scrawl his signature on the device’s screen to validate himself, which can create legibility issues and open the door for a potential chargeback.

“Payments need strong authentication because money is moving between two parties,” says Talach. “Authentication creates trust between the parties involved in the transaction.”

The Big Unknown

Having a global standard for PIN-on-glass and NFC phone-tap technology is also helping the technology gain traction. Creating a standard involves major players in the industry to vet the technology and provide their input to the standards body, says Talach.

In January 2018, the Wakefield, Mass.-based PCI Security Standards Council, which establishes the rules for payment card security, introduced a rule that allows off-the-shelf mobile devices, such as Android phones and iPhones, to accept card transactions and PINs with no hardware attachments.

“We pushed for ratification of the standard because we felt it was an important part of the process for the payments industry to thoroughly develop the technology,” Talach says. “This is a technology the entire industry can now adopt.”

Nevertheless, concerns exist that hackers will find ways to crack the technology.

“With every new technology, it is only a matter of time before vulnerabilities are found, which is why the industry needs to continually evolve the security around the technology,” Tedder says.

The big unknown, says Tedder, is how long it will take for criminals to find the vulnerabilities in PIN-on-glass and exploit them.

One way to slow this assault is to roll it out at a sensible pace. That way, markets can be shaped as they come on online, and security will have the time to evolve to where the industry is not playing catch-up with criminals, says Gollwitzer.

In the meantime, the promise of expanding card acceptance to tens of millions of cash- and check-only merchants is expected to attract bullish new competitors that will push the market for the technology even farther forward.

“This is an innovative payment-acceptance technology, not a replacement for POS hardware,” says Gollwitzer. “More competition will help with the rooting of the technology.”